• Jakob Linke's avatar
    [maglev] Deopt on overflow in >>> · 24e60017
    Jakob Linke authored
    Re-enable the int32 fast path for ShiftRightLogical, but account for
    Maglev's missing signed/unsigned representation tracking by a)
    removing rhs==0 as the identity value (a shift by 0 is still a
    signed-unsigned conversion) and b) deoptimizing if the result cannot
    be converted to a non-negative smi.
    
    Note this is not a deopt loop, since a non-smi result will change the
    feedback to kSignedSmallInputs (from kSignedSmall).
    
    To fix this properly, we should track signed/unsigned representations
    and convert the result to a heap number if it doesn't fit within smi
    range.
    
    Bug: v8:7700
    Change-Id: Ifd538d227a6f1290eb7f008d9bfad586ff91ea0f
    Fixed: v8:13251
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876366Reviewed-by: 's avatarLeszek Swirski <leszeks@chromium.org>
    Commit-Queue: Jakob Linke <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#83025}
    24e60017
Name
Last commit
Last update
..
benchmarks Loading commit data...
bigint Loading commit data...
cctest Loading commit data...
common Loading commit data...
debugger Loading commit data...
debugging Loading commit data...
fuzzer Loading commit data...
fuzzilli Loading commit data...
inspector Loading commit data...
intl Loading commit data...
js-perf-test Loading commit data...
memory Loading commit data...
message Loading commit data...
mjsunit Loading commit data...
mkgrokdump Loading commit data...
mozilla Loading commit data...
test262 Loading commit data...
torque Loading commit data...
unittests Loading commit data...
wasm-api-tests Loading commit data...
wasm-js Loading commit data...
wasm-spec-tests Loading commit data...
webkit Loading commit data...
BUILD.gn Loading commit data...
OWNERS Loading commit data...